Separate USI Management Permissions

It would be ideal to have separate permissions for 'Create USI' and 'Verify USI'. We only want specific people to be able to create a USI because of the misuse ramifications so it would be great if the system could manage this via permissions.

Separating the 'Find USI' permission for similar reasons would also be useful.